ASP.NET Core パスキー認証を実装する① 全体の流れと保存データ

dotnet add package Fido2 --version 4.0.1

using Fido2NetLib;
using Microsoft.AspNetCore.Authentication.Cookies;

var builder = WebApplication.CreateBuilder(args);
builder.Services.AddControllersWithViews();
builder.Services.AddAuthorization();
builder.Services.AddAntiforgery(options =>
{
    options.HeaderName = "X-CSRF-TOKEN";
    options.Cookie.Name = "__Host-csrf";
    options.Cookie.Path = "/";
    options.Cookie.SecurePolicy = CookieSecurePolicy.Always;
    options.Cookie.SameSite = SameSiteMode.Strict;
});
builder.Services.AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme)
    .AddCookie(options =>
    {
        options.Cookie.Name = "__Host-auth";
        options.Cookie.Path = "/";
        options.Cookie.HttpOnly = true;
        options.Cookie.SecurePolicy = CookieSecurePolicy.Always;
        options.Cookie.SameSite = SameSiteMode.Lax;
        options.ExpireTimeSpan = TimeSpan.FromHours(1);
        options.SlidingExpiration = false;
        options.Events.OnRedirectToLogin = context =>
        {
            context.Response.StatusCode = 401;
            return Task.CompletedTask;
        };
        options.Events.OnRedirectToAccessDenied = context =>
        {
            context.Response.StatusCode = 403;
            return Task.CompletedTask;
        };
    });
builder.Services.AddSingleton(new Fido2(new Fido2Configuration
{
    ServerDomain = "localhost",
    ServerName = "サンプルアプリ",
    Origins = new HashSet<string> { "https://localhost:5173" },
}));
// IPasskeyStore の実装を既存の DB アクセス層に用意し、ここで DI 登録する。

var app = builder.Build();
app.UseHttpsRedirection();
app.UseAuthentication();
app.UseAuthorization();
app.MapControllers();
app.Run();

using Fido2NetLib.Objects;

public sealed record PasskeyUser(
    string Id, byte[] UserHandle, string DisplayName, bool IsActive);

public sealed record SavedPasskey(
    byte[] CredentialId, string UserId, byte[] PublicKey,
    uint SignCount, AuthenticatorTransport[] Transports, long Version);

public sealed record PasskeyChallenge(
    string Id, string BrowserId, string Purpose, string? UserId,
    string OptionsJson, DateTimeOffset ExpiresAt);

public interface IPasskeyStore
{
    Task<PasskeyUser?> FindUserAsync(string userId, CancellationToken ct);
    Task<IReadOnlyList<SavedPasskey>> ListAsync(string userId, CancellationToken ct);
    Task<SavedPasskey?> FindCredentialAsync(byte[] credentialId, CancellationToken ct);
    Task SaveChallengeAsync(PasskeyChallenge challenge, CancellationToken ct);
    Task<PasskeyChallenge?> TakeChallengeAsync(
        string id, string browserId, string purpose, CancellationToken ct);
    Task<bool> TryAddAsync(SavedPasskey passkey, CancellationToken ct);
    Task<bool> TryUpdateCounterAsync(
        byte[] credentialId, long expectedVersion, uint signCount,
        CancellationToken ct);
}

var userHandle = System.Security.Cryptography.RandomNumberGenerator.GetBytes(32);

CREATE TABLE app_user (
    id text PRIMARY KEY,
    display_name text NOT NULL,
    is_active boolean NOT NULL DEFAULT true,
    webauthn_user_handle bytea NOT NULL UNIQUE
        CHECK (octet_length(webauthn_user_handle) = 32)
);

CREATE TABLE passkey (
    credential_id bytea PRIMARY KEY,
    user_id text NOT NULL REFERENCES app_user(id),
    public_key bytea NOT NULL,
    sign_count bigint NOT NULL CHECK (sign_count BETWEEN 0 AND 4294967295),
    transports jsonb NOT NULL,
    version bigint NOT NULL DEFAULT 0
);
CREATE INDEX passkey_user_id_idx ON passkey(user_id);

CREATE TABLE passkey_challenge (
    id text PRIMARY KEY,
    browser_id text NOT NULL,
    purpose text NOT NULL CHECK (purpose IN ('register', 'login')),
    user_id text REFERENCES app_user(id),
    options_json text NOT NULL,
    expires_at timestamptz NOT NULL,
    UNIQUE (browser_id, purpose)
);
CREATE INDEX passkey_challenge_expiry_idx ON passkey_challenge(expires_at);

INSERT INTO passkey_challenge
    (id, browser_id, purpose, user_id, options_json, expires_at)
VALUES
    (@id, @browser_id, @purpose, @user_id, @options_json, @expires_at)
ON CONFLICT (browser_id, purpose) DO UPDATE SET
    id = EXCLUDED.id,
    user_id = EXCLUDED.user_id,
    options_json = EXCLUDED.options_json,
    expires_at = EXCLUDED.expires_at;

DELETE FROM passkey_challenge
WHERE id = @id
  AND browser_id = @browser_id
  AND purpose = @purpose
  AND expires_at > CURRENT_TIMESTAMP
RETURNING id, browser_id, purpose, user_id, options_json, expires_at;

builder.Services.AddScoped<IPasskeyStore, PasskeyStore>();